Oracle PeopleSoft PeopleTools: Missing authentication in Business Interlink
Summary
Oracle PeopleSoft Enterprise PeopleTools versions 8.61 to 8.63 contain a flaw in the Business Interlink component that allows an unauthenticated attacker with network access via HTTP to compromise the product. Oracle reports a successful attack can lead to takeover of PeopleTools, with high impact on confidentiality, integrity and availability. The attack complexity is rated high, so exploitation requires specific conditions. Oracle fixed the issue in the October 2026 Critical Patch Update.
Affected
- Oracle PeopleSoft Enterprise PeopleTools 8.61 to 8.63 (upper bound per VulDB: up to 8.63)
Fixed in
- Fixed in the Oracle October 2026 Critical Patch Update. Exact patch level: Unknown. Check the Oracle advisory.
Workaround
- No vendor workaround known.
- Interim until patching: restrict network access to the PeopleSoft web tier and confirm the Business Interlink component is not exposed beyond what is needed.
Exploitation
- Exploited in the wild: not found for this CVE.
- Public proof of concept: not found.
- CISA KEV status: not checked.
Our recommendation
- Check whether PeopleSoft PeopleTools is in use and which versions run.
- Apply the October 2026 Oracle Critical Patch Update to affected PeopleTools instances without delay, prioritising internet-facing systems.
- Restrict access to the web tier and monitor for unusual HTTP activity against PeopleSoft.
- Review the Oracle advisory for the exact fixed patch level.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Oracle Critical Patch Update October 2026 www.oracle.com
- NVD CVE-2026-101390 vulners.com
- VulDB 423099 vuldb.com
- Vulners CVE data CVE-2026-101390 vulners.com
- Tenable: Oracle October 2026 CPU www.tenable.com
- PeopleTools overview en.wikipedia.org
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 18:32.
Original description (NVD)
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Business Interlink). Supported versions that are affected are 8.61-8.63. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks of this vulnerability can result in takeover of PeopleSoft Enterprise PeopleTools. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.